Managing Android Devices: Workspace ONE Operational Tutorial

On your desktop, double-click the Google Chrome icon.

For example, navigate to https://<WorkspaceONEUEMHostname> where WorkspaceONEUEMHostname is the host name of the Workspace ONE UEM console.

1. Enter your Username, for example, administrator.
2. Click Next. After you click Next, the Password text box is displayed.

1. Enter your Password, for example, VMware1!
2. Click Login.

Note: If you see a Captcha, be aware that it is case sensitive.

In the Workspace ONE UEM console, at the appropriate Organization Group level:

1. Click Groups & Settings.
2. Click All Settings.

1. Select Devices & Users.
2. Expand Android.
3. Select Android EMM Registration.
4. Click Register with Google.

1. Confirm you are logged into your Google Admin Account that you want to associate with your Android for Work configuration. For example, enter WorkspaceONEadmin@gmail.com. Note: After you register a Google Admin Account to Android for Work, you cannot disassociate your Google Admin Account from that Organization. Ensure the Google Admin Account shown is the account you want to associate with your Organization.
2. Click Get Started.

1. Enter your Organization Name.
2. Select the Google Play Agreement.
3. Click Confirm.

Click Complete Registration to return to the Workspace ONE UEM configuration.

Return to the Android EMM Registration page in the Workspace ONE UEM Console:

1. On the Configuration tab, scroll down to the Google Admin Console Settings section. Note that the account information you provided to Google displays here.
2. Confirm the Android EMM Registration Status is shown as Successful.
3. Note how the Client ID and Google Service Account Email Address have been automatically created and configured.  

Before you can perform the exercises in this tutorial, you must meet the following requirements.

• Android device running version 5.0 or later
• Factory reset device in out of the box mode
• Retrieve the Group ID from Workspace ONE UEM Console

Caution: Do not factory reset your personal device to complete these exercises.

This exercise requires a user to enroll their device into Workspace ONE UEM. Note the information in the following table. The details provided in this table are based on a test environment. Your user account details will differ.

In this activity, use Workspace ONE Intelligent Hub Identifier enrollment to set up your device in Work Managed Device mode.

Note: Screenshots may differ due to differences in device models and operating system versions.

Turn on your device from a factory reset state and tap the arrow.

1. Accept the End User License Agreement.
2. Tap Next.

1. Tap Skip this for now.
2. Tap Next.

After the agent has launched, you can enroll the device. In this activity, configure Workspace ONE UEM authentication details.

After the device restarts, you are ready to complete device enrollment. During the enrollment process, you will see several processing screens. You do not need to interact with the device further until you see the Workspace ONE Intelligent Hub app confirming your enrollment.

Before you can complete this exercise, you must successfully enroll an Android device in Work Managed mode.

In this activity, control camera settings by configuring a restrictions profile for a Work Managed Android device in the Workspace ONE UEM console.  

For Android, the various device modes change the way profile settings apply to devices. After configuring a restriction profile, test the profile settings to see how they applied on your Work Managed Android device.

Before you can complete this exercise, you must successfully enroll an Android device in Work Profile mode.

In this exercise, you deploy Workspace ONE Web, a public application, to your Android device. Applications that you push through the integration of Workspace ONE UEM and Android Enterprise have the same functionality as their counterparts from the Google Play Store. However, you can use Workspace ONE UEM features to add functionality and security to these applications.

After using the Workspace ONE UEM console to push Workspace ONE Web to your Android device, verify the Work app installed correctly on your device.

Note: Screenshots may differ depending on device model and OS.

Before you can perform the exercises in this tutorial, you must meet the following requirements.

• Android device running version 5.0 or later
• Ensure this device has an associated personal user account
• Retrieve the Group ID from Workspace ONE UEM Console

This exercise requires a user to enroll their device into Workspace ONE UEM. Note the user account information in the following table. The details provided in this table are based on a test environment. Your user account details will differ.

In this section, enroll your device in Workspace ONE UEM and set it up in Work Profile mode. You need to encrypt data on your device during this process. Depending on the amount of data on your device, this can take some time. Be patient until you see the next enrollment prompt.

Note: Screenshots may differ due to differences in device models and operating system versions.

After you have enrolled your Android device in Work Profile mode, you should now see the new Work applications. Android for Work apps are differentiated by an orange briefcase icon also referred to as Badged Apps. Depending on your device version, you might see a Work container with your badged apps. This section reviews both scenarios.

Before you can complete this exercise, you must successfully enroll an Android device in Work Profile mode.

To create a new restrictions profile, follow steps 1 to 4 in Configuring Android Profiles. Then, continue to the next step.

In this exercise, control camera settings by configuring a restrictions profile in the Workspace ONE UEM console.  

For Android, the various device modes change the way profile settings apply to devices. After configuring a restriction profile, test the profile settings to see how they applied on the Android device.

In the Workspace ONE UEM console, at the appropriate Organization Group level:

1. Click Groups & Settings.
2. Click All Settings.
3. Navigate to Devices & Users > Android > Android EMM Registration.

1. On the Android EMM Registration page, click Enrollment Settings.
2. Next to Fully-Managed Device Enrollments, select Corporate Owned Personally Enabled.
3. Click Save.

Before you can enroll your device, you must generate the enrollment QR Code in the Workspace ONE UEM console.

In the Workspace ONE UEM console, in the appropriate Organization Group:

1. Click Devices.
2. Click Staging & Provisioning.
3. Click Staging.
4. Click Configure Enrollment.

On the Enrollment Configuration Wizard page that appears:

1. Under Platform, click Android.
2. Under Enrollment, select QR Code.
3. Click Configure.

In the enrollment wizard, configure Wi-Fi settings for enrollment:

1. Set Connect device to Wi-Fi prior to enrollment to Enabled.
2. Enter your Wi-Fi network name or SSID. For example, VMware Guest.
3. Enter your Wi-Fi Password.
4. Click Next.

1. From the Workspace ONE Intelligent Hub drop-down menu, select Use latest Workspace One intelligent Hub.
2. Click Next.

1. Set Configure Organization Group to Enabled.
2. Select your Organization Group.
3. Set Login Credentials to Enabled.
4. Enter a User Name. For example, staging.
5. Enter your Password.
6. Click Next.

On the Summary tab:

1. Click Download File and save your QR code to a secure, accessible location.
2. Click Close.

The QR code you generated in the Workspace ONE UEM console contains a payload of key-value pairs with all the information the device needs to enroll. In this section, follow-along with the steps in the video to enroll your Android COPE device using the QR code you generated.

Before you can complete this exercise, you must successfully enroll an Android device in COPE mode.

To create a new restrictions profile, follow steps 1 to 4 in Configuring Android Profiles. Then, continue to the next step.

In this exercise, control camera settings by configuring a restrictions profile in the Workspace ONE UEM console.

After the restrictions profile pushes to the device:

1. Notice that a badged enterprise version of the camera application is not available.
2. Notice that the unbadged personal camera remains available.

Open your non-badged Contacts app, and try to take a screenshot within the app. Notice that the screen shot was successful.

Open the badged Contacts app, and try to take a screenshot within the app. Notice that the screenshot was unsuccessful. In certain device models and OS versions, a message may also appear.

1. Select Next after all devices are validated for migration. You cannot select next until a valid Smart Group is selected.
   A Summary page displays showing details such as list of devices, eligibility of migration, and reason the device migrated successfully or failed.
2. Select Create to display the migration List View to review the status of devices being migrated. From this page you can select migrations from the list view to display the Migration Details page.

Note: During Android (Legacy) migration to Android Enterprise, based on the setting in the Scheduler, the migration command is automatically sent for the first batch size (300) of devices instantly. After the first 300 devices, the remaining devices will receive the command at the determined intervals. You can view the settings in the UEM console under Admin > Scheduler.

The Legacy Android Migration List View automatically displays after you create a new migration page. The list view helps you to view all the real-time updates of your end-user devices that you are migrating with the Workspace ONE UEM console. The list view allows you to:

• Edit specific migrations by selecting the radio button on the desired migration friendly name. You can update the migration for new devices added to the Smart Group by selecting Edit.
• Delete migration groups that prevent devices in the queue from migrating from Legacy Android by withdrawing the persistent notification. Android Work Profile is not removed from devices that have already migrated.
• Search and narrow down a device using the Search option.

The Migration Details page is accessed by selecting a migration Friendly Name from the Legacy Android Migration List View with the Workspace ONE UEM console to review the status of the migration. You can view a graphical overview, status, and reason for the migration failing or succeeding.

• Use the Migration Details page to push the migration command to the device with the Retry button if the migration fails.
• Customize a message to the devices in the migration batch with the Notify button. Configure the field as follows:
  • Message Type: Select the message type (email, SMS, or push) that Workspace ONE UEM uses for this template.
  • Subject: Enter the message subject.
  • Message Body: Enter the message Workspace ONE UEM displays on the end-user devices for each message type.

The Workspace ONE UEM console provides a seamless process that helps you migrate all devices from Android (Legacy) to a Work Profile for Android Enterprise. The migration features in the UEM console help you to make sure that:

• Your legacy administration remains intact until migration is complete.
• Devices not being migrated are never affected.
• Monitor which devices are complete, in progress, and assigned.
• Create staging or test Smart Groups to make sure that all user devices successfully migrate before migrating your entire device fleet.

You can migrate from Android (Legacy) to Android Enterprise with your corporate owned devices into Work Managed Mode or Corporate Owned Personally Enabled (COPE). The enrollment and migration options vary depending on Android OS, device type, and whether the devices have access to Google Services.

The migration and enrollment options are:

• Use Zero Touch enrollment for Android 8.0+ devices.
• Use Knox Mobile Enrollment for Samsung Android 8.0+ devices.
• Follow the Cap and Grow strategy and continue to use your current Android devices enrolled through Android (Legacy). A Cap and Grow strategy means that any new device rollouts are automatically enrolled into Android Enterprise and managed simultaneously with older deployments (Android (Legacy) until your organization is ready to move all devices to Android Enterprise.

If you are currently enrolled into Workspace ONE UEM with Android devices deployed through Android (Legacy) and want to switch to Android Enterprise without Google Services, we offer Closed Network support for corporate owned devices and unmanaged enrollment for BYOD devices.

If you have a device that has no network connectivity or the device can connect to a network but has no Google services (a non-GMS certified device), you can enroll these devices into Android Enterprise into Work Managed Mode and push internal applications and apply policies with Android profiles.

If you have a device that has network connectivity but has restrictions on Google Services, for example devices being in China, you can use Closed Network support for corporate devices. For BYOD devices, you can use SDK-based MAM only mode called Registered Mode to enable unmanaged enrollment for Android devices.

Google deprecated certain device administrator APIs in favor of more up-to-date device functionality because device administrator is not well suited to support current enterprise requirements. The following APIs available with device administrator no longer function on devices running Android 10 and later. Devices remaining on Android 9.0 and earlier are not impacted:

• USES_POLICY_DISABLE_CAMERA
• USES_POLICY_DISABLE_KEYGUARD_FEATURES
• USES_POLICY_EXPIRE_PASSWORD
• USES_POLICY_LIMIT_PASSWORD